Ransomware gang abuses Microsoft Teams relays to hide malicious traffic

A ransomware gang identified as DragonForce is using Microsoft Teams’ relay servers to mask malicious traffic, according to coverage from multiple cybersecurity outlets. The tactic allows attackers to blend their communications with legitimate Teams activity, making detection harder. Coverage from *CyberPress*, *Security.com*, *Infosecurity Magazine*, and *BleepingComputer* highlights the technical sophistication of the attack, noting that DragonForce leveraged Microsoft’s infrastructure to bypass traditional security measures.

The reports emphasize the growing risks posed by threat actors exploiting trusted platforms for covert operations. Microsoft has not yet issued a public statement on the matter. Watch for potential updates from Microsoft on mitigation steps or patches, as well as further analysis from cybersecurity firms on how widely this tactic is being deployed.

Organizations using Teams may need to review their security protocols to detect anomalous relay activity.